SECURE CONTROL OF INSECURE DEVICE

Description

Technical Field

[0001] The invention relates to the remote control of an insecure device, and particularly to a computer system and method for securely controlling an insecure computer.

Background

[0002] Remote desktop software is widely used to provide the user of a local, client computing device with the resources and functionality available to a second, remote computing device. The software typically allows the user to access and control the desktop environment of the remote computer using the client computer by providing the client computer with a view of the user interface of the remote computer, and by transmitting user input from the client computer to the remote computer.

[0003] There are a number of applications of remote desktops. For example, employees who wish to work from home, or while they are otherwise out of their office, can use the software to access their office desktop environment. Alternatively, now that cloud computing is widely available, many people access software and other resources that are stored on servers in data centres. As another example, IT support staff may use remote desktop software to take control of a user's desktop to provide troubleshooting. Frequently used remote desktop software for such applications include Citrix® and Apple® Remote Desktop.

[0004] Remote desktop software operates through a client/server model. A client component of the remote desktop software is installed on the client computer, and a server component of the software is installed on the remote computer. If the client computer is connected to the remote computer through a network, the client and server components of the software can communicate. This necessarily involves bidirectional communication over the network, with the view of the desktop environment of the remote computer being transmitted over the network in one direction, and user input being transmitted over the network in the other direction.

[0005] While known remote desktop software is adequate in many situations, security may be a concern. This is especially the case where the client computer is a relatively secure computer, while the remote computer is relatively insecure. If an insecure remote computer is connected to the internet and has been compromised by a third party, or is running malicious software, it may represent an unacceptable risk to the secure computer. For example, the malicious software may be able to craft communications to the secure device over the network, thus gaining control over the secure device.

[0006] It is an object of embodiments of the present invention to provide for the control of an insecure computer from a secure computer, with the security of the secure computer guaranteed.

[0007] United States Patent Application with publication number US 2014/0075535 A1 describes a streaming video security device that comprises an input LAN interface, a video decoder, a video encoder and an output LAN interface. The streaming video security device receives streaming IP video, performs a double conversion of the IP video using the decoder and encoder, and then forwards the IP video. Any injected data or malicious code in the received IP video cannot pass the double conversion process.

[0008] United States Patent Application with publication number US 2014/0136657 A1 describes a data transfer system that includes two unidirectional data transfer links. One of the links may be configured to pass keyboard and mouse data, and the other may be configured to pass only graphical display data. The two links are configured using data sending and receiving applications and data sending and receiving configuration files.

[0009] United States Patent Application with publication number US 2011/0208963 A1 describes a system comprising a secure KVM which is coupled to a secure KVM remote Controller-Indicator. The secure KVM enables switching between multiple coupled host computers. The secure KVM remote controller-indicator interfaces with the user using input/output devices such as a keyboard, a mouse and a monitor.

Summary of the Invention

[0010] The invention is defined in the independent claims to which reference is now directed. Preferred features are set out in the dependent claims.

[0011] Providing the system with a unidirectional dataflow enforcer, which allows dataflow from the secure computer to the insecure computer but prevents dataflow from the insecure computer to the secure computer, allows the secure computer to control the insecure computer without any risk of the insecure computer compromising the secure computer using the connection over which the unidirectional dataflow enforcer is implemented. At the same time, providing the secure computer with the video output of the insecure computer gives the secure computer a view of the screen image of the insecure device, which is necessary to provide effective control, but the dedicated, hardware implemented nature of the video output eliminates any risk of the insecure computer compromising the secure computer over the video connection. This is because it is not possible for software instructions to modify the way in which the video output is communicated over the dedicated video output, which is typically only capable of transmitting raw, uncompressed bitmap data of a screen image. The computer system therefore provides for the secure control of an insecure computer.

[0012] It will be understood that the terms "secure computer" and "insecure computer" are relative terms, and are not intended to limit the invention to any particular hardware or software configuration. A secure computer in the context of the present invention may be one in which the user has, and takes steps to maintain, a high level of confidence that there is no malicious software running on the computer. An insecure computer may be one in which the user has a lower confidence, and may accept that there is a possibility that malicious software could be running on the computer. A user may take a variety of steps to secure a computer, including hardware steps, such as limiting the types of connections to and from the computer, and software steps, such as using a firewall or a dedicated, cryptographically secured communication protocol.

[0013] The term "screen image" of the insecure computer will be understood to refer to an image of the operating system interface display of the insecure computer. A view of the screen image allows a user to interface with the insecure computer, since the user can see the operating system interface and determine appropriate inputs, and see the results of the inputs.

[0014] The unidirectional dataflow enforcer may be implemented in hardware, software, or a combination of hardware and software. What is important is that malicious instructions from the insecure computer are not able to craft communications to the secure computer by disabling or bypassing the unidirectional dataflow enforcer.

[0015] Dedicated hardware implementations of the unidirectional dataflow enforcer have the advantage that the hardware does not allow instructions to flow from the insecure computer to the secure computer. Dedicated hardware implementations include a unidirectional optical link comprising optical transmission hardware, which may be a laser, and optical receiver hardware; a unidirectional electronic transmission connection, such as one connection of a serial port link that uses different electrical connections for each direction of communication; or a custom electronic device such as an application-specific integrated circuit (ASIC) or programmable logic device (PLD) in which the functionality is physically hardwired.

[0016] Combined hardware and software implementations include custom electronic devices, such as ASICs and PLDs in which the unidirectional dataflow functionality is not physically hardwired, but in which the hardware can only access software stored in read only memory (ROM) or programmable ROM (PROM), which cannot be altered without accessing the internals of the device. Combined hardware and software implementations have the advantage of a combination of high security and relative ease of implementation of additional functionality.

[0017] Pure software implementations have the advantage that it is relatively easy to implement additional functionality. The software may be stored and executed on the secure computer or on an intermediate computing platform.

[0018] In some implementations, the unidirectional dataflow enforcer may have additional functionality. The unidirectional dataflow enforcer may be able to monitor the instructions that are transmitted across the second connection. Monitoring may involve producing a log of instructions sent across the link, and may involve transmitting the log to the secure computer. Monitoring instructions may be helpful in identifying any evidence of the second connection being used to leak sensitive information.

[0019] The computer system may further comprise a converter to convert the video output of the insecure computer to a form that the secure computer can receive. The secure computer may receive the video output of the insecure computer through a camera input port of the secure computer.

[0020] The dedicated video output of the insecure computer may be one of the following interface technologies: VGA, DVI, HDMI, DisplayPort or DSI.

[0021] In one embodiment the secure computer may be further configured to transmit the video output to a second secure computer over a third connection, and to receive instructions for controlling the insecure computer from the second secure computer over the third connection. The second secure computer may be part of the computer system, and may be configured to receive the video output of the insecure computer from the secure computer over the third connection. The second secure computer may be further configured to transmit instructions, for controlling the insecure computer, to the secure computer over the third connection.

[0022] The embodiment involving a second secure computer may be particularly advantageous in implementations involving a data centre or the like. A single secure computer in a data centre may be used to serve a plurality of second secure computers located outside of the data centre, since there is no requirement for the secure computer to include output means, such as a monitor, or input means, such as a keyboard or mouse, as these could be coupled to the plurality of second secure computers.

[0023] In implementations involving a second secure computer, the secure computer may be further configured to compress the video output before forwarding it to the second secure computer. This has the advantage of reducing bandwidth requirements.

[0024] In some implementations, the insecure computer may be further configured to transmit audio output to the secure computer over the first connection. References to a dedicated video output of the insecure computer may therefore also be considered as references to a dedicated video and audio output.

[0025] In some implementations, the instructions for controlling the insecure computer are user instructions input on one or more input devices.

[0026] A corresponding method of securely controlling a computer may be provided. The method comprises transmitting, in the form of uncompressed bitmap data, a screen image of the operating system interface of an insecure computer to a secure computer over a video connection. The method further comprises enforcing unidirectional dataflow between the secure computer and insecure computer over a second connection by allowing dataflow from the secure computer to the insecure computer over the second connection, and by preventing dataflow from the insecure computer to the secure computer over the second connection. The method further comprises receiving, from the secure computer, at the insecure computer, over the second connection, instructions for controlling the insecure computer.

Brief Description of the Drawings

[0027] The invention will now be further described by way of example only and with reference to the accompanying figures in which:

Figure 1 is a schematic diagram of a computer system according to an embodiment of the invention;

Figure 2 is a schematic diagram of a computer system according to a second embodiment of the invention; and

Figure 3 is a schematic diagram of a computer system according to a third embodiment of the invention.

Detailed Description

[0028] Figure 1 shows a first computer (100) that is controlled by a second computer (200) via a unidirectional dataflow enforcer (400). The second computer (200) is more secure than the first computer (100). For reference purposes the first computer (100) will be referred to as the insecure computer (100) and the second computer (200) will be referred to as the secure computer (200).

[0029] The insecure computer (100) will include a dedicated video output with a hardware interface (101). This output (101) provides an output of a screen image that is generated by the insecure computer (100). The video output is in the form of uncompressed bitmap data, which may be encapsulated into a digital communications protocol. Insecure computer (100) is configured to transmit the video output over a first connection, which may be a wired or wireless connection. Insecure computer (100) is also configured to receive instructions for controlling the insecure computer (100) from the secure computer (200) over a second connection, as discussed further herein.

[0030] The secure computer (200) is configured for receiving the video output of the insecure computer (100) from the insecure computer (100) over the first connection. The secure computer (200) may include a camera input port (201), or other known hardware, to receive the video output of the insecure computer (100) over the first connection. The secure computer (200) is further configured to transmit instructions for controlling the insecure computer (100) over the second connection.

[0031] The computer system includes a unidirectional dataflow enforcer (400) which is configured to enforce unidirectional dataflow between the secure computer (200) and the insecure computer (100) over the second connection. The unidirectional dataflow enforcer (400), which may be implemented in hardware, software, or a combination of the two, allows dataflow from the secure computer (200) to the insecure computer (100), but prevents dataflow from the insecure computer (100) to the secure computer (200).

[0032] In use, the insecure computer (100) will generate video output. For example, the insecure computer (100) may be connected to the internet and be receiving video content from a server hosting a webpage. The insecure computer (100) will then generate a screen image using a graphics processing unit and possibly audio, based at least in part on the content, and transmit the screen image over the first connection via the dedicated video output with a hardware interface (101). The secure computer (200) will then receive the video output of the insecure computer (100) over the first connection, whether by camera input port (201) or otherwise.

[0033] Because dedicated video output (101) is implemented in hardware, with signals generated over the interface generated by a dedicated single function controller, rather than by general software, malicious software or instructions cannot affect the way that the screen image is communicated over the first connection. Malicious software may be able to affect the appearance of the screen image, but cannot affect how it is communicated. As such, any malicious control of the insecure computer (100), or any malicious software running on the insecure computer (100), does not represent a security risk to the secure computer (200) in respect of the first connection.

[0034] In some cases the insecure computer (100) may also generate audio output. The insecure computer (100) may then be configured to transmit the audio output to the secure computer (200), in addition to the video output, via a dedicated, hardware implemented, output.

[0035] The secure computer (200) will deliver the video output of the insecure computer (100) to a user, for example through a monitor. Since the user can see the screen image of the insecure computer (100), they can determine and input appropriate instructions for controlling the insecure computer (100). Such instructions may be input using a mouse, keyboard or touch screen connected to the secure computer (200), for example. These instructions are then transmitted to the insecure computer (100) over the second connection.

[0036] Unidirectional dataflow enforcer (400) allows dataflow from the secure computer (200) to the insecure computer (100) over the second connection. The instructions transmitted by the secure computer (200) for controlling the insecure computer (100) are therefore allowed to pass through the unidirectional dataflow enforcer (400) to the insecure computer (100), where they are received.

[0037] The instructions received by the insecure computer (100) will then be processed to affect the control of the insecure computer (100) by the secure computer (200).

[0038] Since the unidirectional dataflow enforcer (400) prevents dataflow from the insecure computer (100) to the secure computer (200), the insecure computer (100) cannot use the second connection as a means to compromise the secure computer (200). Malicious control of, or malicious software running on, the insecure computer (100) does not, therefore, represent a security risk to the secure computer (200).

[0039] The computer system therefore allows for the secure control of an insecure computer (100). The secure computer (200) is able to provide instructions to control the insecure computer (100) over one connection, and is able to receive video output of the screen image of the insecure computer (100) over another connection. However, due to the presence of the unidirectional dataflow enforcer (400) on one connection, and due to the dedicated, hardware implemented nature of output of the insecure computer, the insecure computer (100) cannot compromise the security of the secure computer (200).

[0040] The dedicated video or video and audio output of the insecure computer (100) may be any appropriate interface technology. For example, the video output may use a technology such as VGA, DVI,HDMI, DisplayPort or DSI. Where there is also audio, the output may be combined with the video, as in HDMI, or there may be a separate, dedicated, hardware implemented, audio output that uses a separate connection.

[0041] As previously mentioned, secure computer (200) may have a camera input port (201), or other known hardware, to receive the video output of the insecure computer (100) over the first connection. In some implementations, it may be necessary to convert the video or video and audio output of the insecure computer (100) into a form that the secure computer (200) can receive, whether by the camera input port (201) or otherwise. Where this is the case, the system can include a converter (300). The converter (300) may be part of, or be coupled to, the insecure computer (100) or the secure computer (200), or may form part of the first connection. In some implementations, the camera input port (201) may be a MIPI CSI-2 camera input port, and the converter may have an HDMI input and CSI-2 output. In other implementations, rather than a camera input port, the secure computer (200) may have a generic interface such as USB, and the converter may have an HDMI input and a generic output, such as according to the USB standard. Since the security of the video output is guaranteed by the dedicated video output with a hardware interface (101), the precise details of how the video output is received by the secure computer (200) may not matter.

[0042] Figure 2 shows a second embodiment according to the invention in which the objective is to allow a third computer (500) to securely control the insecure computer (100). The third computer (500) is relatively secure compared to the insecure computer (100), and may be secured to the same level as the secure computer (200). For reference purposes, computer (200) will be referred to as the first secure computer and computer (500) will be referred to as the second secure computer.

[0043] The insecure computer (100) has the same configuration as the insecure computer (100) of Figure 1. It includes a dedicated, hardware implemented, video or video and audio output (101), and is configured to transmit the video or video and audio output to the first secure computer (200) over the first connection. The insecure computer (100) is further configured to receive instructions for controlling the insecure computer (100) from the first secure computer (200) over the second connection.

[0044] The first secure computer (200) is configured to receive the video, or video and audio, output from the insecure computer (100) over the first connection and to transmit it to the second secure computer (500) over a third, secure, connection. The first secure computer (200) is further configured to receive instructions for controlling the insecure computer (100) from the second secure computer (500) over the third connection and to transmit the instructions to the insecure computer (100) over the second connection.

[0045] The second secure computer (500) is configured to receive the video or video and audio output of the insecure computer (100) from the secure computer (200) over the third connection. The second secure computer (500) is further configured to transmit instructions for controlling the insecure computer (100) to the secure computer (200) over the third connection.

[0046] The system also includes a unidirectional dataflow enforcer (400), configured as described in the embodiment of Figure 1.

[0047] In some implementations of the embodiment of Figure 2, it is not necessary for the first secure computer (200) to be coupled to any means for inputting user instructions, such as keyboard or mouse, as the secure computer (200) receives the instructions for controlling the insecure computer (100) from the second secure computer (500). Likewise, it may not be necessary for the first secure computer (200) to be coupled to any means to output the screen image, such as a monitor, as the video or video and audio output is transmitted to the second secure computer (500).

[0048] The first and second secure computer may communicate over a secure network. The third, secure, connection may be a dedicated network connection between the second secure computer (500) and the first secure computer (200), such as a wired or wireless connection. The first secure computer (200) and the second secure computer (500) may be connected as part of a local area network (LAN) or as part of a wide area network (WAN). The connection may also be a VPN connection established over the internet, or even a normal internet connection if measures have been taken to secure the connection to a level acceptable to the user. Measures may include locating the computers behind firewalls which only allow communication to specific IP addresses, or using a dedicated communication protocol secured by cryptography, such as TLS or SSL, for communication between the two secure computers.

[0049] In one implementation of the embodiment of Figure 2, the second secure computer (500) is a computer operated by an employee or the like, while the first secure computer (200) and the insecure computer (100) are located in a data centre. The first secure computer (200) effectively acts as a secure interface between the second secure computer (500) and the insecure computer (100), and the system allows the user of the second secure computer (500) to securely access potentially insecure content by viewing the screen image of the insecure computer (100) over connections that are guaranteed to be secure.

[0050] In some implementations, the first secure computer (200) may encode or compress the video, or video and audio, data using some form of video/audio compression before transmitting it to the second secure computer (500). This can help minimise bandwidth requirements.

[0051] Figure 3 shows a third embodiment of the invention in which the unidirectional dataflow enforcer (400) has additional functionality. Figure 3 illustratively shows this in accordance with the embodiment of Figure 1, but it will be understood that the additional functionality described herein could be also implemented in accordance with the embodiment of Figure 2.

[0052] In the embodiment of Figure 3, unidirectional dataflow enforcer (400) includes audit interface (401). Audit interface (401) may be any appropriate means for implementing the relevant functionality, and may be implemented by hardware, software, or a combination of the two.

[0053] One example of the functionality that could be implemented by audit interface (401) is the auditing of instructions that are transmitted across the second connection. For example, audit interface (401) may audit instructions corresponding to user inputs via input devices, including mouse clicks and keyboard strokes, and may be helpful in identifying any evidence of the second connection being used to leak sensitive information. Auditing may involve producing a log of all instructions sent across the link, typically for real-time or subsequent analysis. The log or associated information may be transmitted to the first secure computer (200), the second secure computer (500) or another computer, over a fourth connection, which may be a dedicated connection.

[0054] As mentioned previously, unidirectional dataflow enforcer (400) and the optional auditing interface (401) may be implemented as hardware, software or a combination of the two. Further, unidirectional dataflow enforcer (400) may be implemented on one, the other, or both of secure computer (200) and insecure computer (100). Various implementations of a unidirectional dataflow enforcer, sometimes referred to as a "data diode", are possible, and some exemplary implementations will now be described.

[0055] In one implementation which is considered particularly secure, unidirectional dataflow enforcer (400) is implemented in hardware using an optical link. In this implementation, secure computer (200) includes, or is coupled to, optical transmission hardware, such as a laser, and insecure computer (100) includes a corresponding optical receiver. This allows the transmission of instructions from the secure computer (200) to the insecure computer (100), but because the insecure computer (100) does not include an optical transmitter, and secure computer (200) does not include an optical receiver, it is not physically possible for data to flow from the insecure computer (100) to the secure computer (200). It will be understood that this implementation could make use of a medium for carrying the optical signal, such as an optical fibre. Alternatively, there may not be such a medium, in which case a line of sight between the transmitter and receiver may be necessary.

[0056] In an alternative hardware implementation, the unidirectional dataflow enforcer (400) is one electrical transmission connection of a connection that uses different electrical connections for each direction of communication. For example, the connection may be one connection of a serial port according to the RS-232 standard. Data can flow in one direction, from the secure computer (200) to the insecure computer (100), but the hardware controlling the RS-232 link would not allow data to flow in the opposite direction.

[0057] A further approach typically considered to be high-security is to create a low level custom electronic hardware device, such as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), to enforce unidirectionality. Such a device may enforce unidirectionality entirely through hardware, by physically hardwiring the functionality, or through a combination of hardware and software using, for example, a configuration in which the hardware can only access software stored on a Read Only Memory (ROM) or Programmable ROM (PROM) that is not alterable by software or without accessing the internals of the device.

[0058] In another implementation, unidirectionality may be enforced by software on the secure computer (200) or on an intermediate computing platform. Such software could be developed using formal methods such as formally verifiable or high assurance instructions. However, there is always a risk that the software (or any other software on which it depends, such as an operating system) could contain a vulnerability which could be exploited by suitably crafted communications from the insecure computer (100). Thus, higher security approaches such as those described above are often preferred. It would not usually be considered appropriate for the unidirectionality to be enforced by software on the insecure computer (100), as this could be disabled or bypassed if the insecure computer (100) was compromised.

Claims

1. A computer system for providing secure control of a computer, the system comprising an insecure computer (100) and a secure computer (200):

the insecure computer having a dedicated video output with a hardware interface (101), and configured to transmit, by the video output, in the form of uncompressed bitmap data, a screen image of its operating system interface to the secure computer over a first connection, and to receive instructions for controlling the insecure computer from the secure computer over a second connection;

the secure computer being configured to receive the video output of the insecure computer over the first connection and to transmit instructions for controlling the insecure computer over the second connection;

the system further comprising a unidirectional dataflow enforcer (400) configured to enforce unidirectional dataflow between the secure computer and the insecure computer over the second connection, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented;

wherein the secure computer (200) is further configured to transmit the screen image of the operating system interface of the insecure computer (100) to a second secure computer (500) over a third connection, and to receive instructions for controlling the insecure computer from the second secure computer over the third connection; and wherein the secure computer (200) is configured to compress the screen image before forwarding it to the second secure computer (500).

2. The system of claim 1, wherein the unidirectional dataflow (400) enforcer comprises either:

an optical link, the optical link comprising transmission hardware coupled to the secure computer (200) and receiving hardware coupled to the insecure computer (100), wherein the transmission hardware comprises a laser; or

an electronic transmission link wherein electronic transmission can only occur from the secure computer to the insecure computer, wherein the electronic transmission link is one connection of a serial port link that uses different electrical connections for each direction of communication.

3. The system of any preceding claim, wherein the unidirectional dataflow enforcer (400) is a custom electronic device, being one of: a programmable logic device or an application-specific integrated circuit.

4. The system of any preceding claim, wherein the dedicated video output with a hardware interface (101) is one of the following interface technologies: VGA, DVI, HDMI, DisplayPort or DSI.

5. The system according to any preceding claim, wherein the unidirectional dataflow enforcer (400) is configured to monitor the instructions transmitted over the second connection, wherein monitoring the instructions transmitted over the second connection comprises producing a log of the instructions, and wherein the log of the instructions is transmitted to the secure computer over a dedicated interface (401).

6. The system of any preceding claim wherein the instructions for controlling the insecure computer (100) are user instructions input using one or more input devices.

7. The system of any preceding claim wherein the insecure computer (100) is further configured to transmit audio output to the secure computer (200) over the first connection.

8. A system comprising the computer system of any preceding claim and further comprising the second secure computer (500) of claim 1.

9. A method of operating a computer system for providing secure control of a computer, the system comprising an insecure computer (100), a secure computer (200), and a unidirectional dataflow enforcer, the insecure computer having a dedicated video output with a hardware interface (101), the method comprising
transmitting, by the video output of the insecure computer, in the form of uncompressed bitmap data, a screen image of its operating system interface to the secure computer over a first connection between the insecure computer and the first secure computer;
receiving, by the secure computer, the video output of the insecure computer over the first connection;
transmitting, from the secure computer to the insecure computer, instructions for controlling the insecure computer over a second connection between the insecure computer and the secure computer; and
receiving, by the insecure computer, instructions for controlling the insecure computer from the secure computer over the second connection;
enforcing, by the unidirectional dataflow enforcer (400), unidirectional dataflow between the secure computer and the insecure computer over the second connection, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented;
compressing, by the secure computer, the screen image of the operating system interface of the insecure computer (100) and transmitting the compressed screen image of the operating system interface of the insecure computer (100) from the secure computer to a second secure computer (500) over a third connection; and
receiving, by the secure computer, instructions for controlling the insecure computer from the second secure computer over the third connection.

Ansprüche

1. Computersystem zum Bereitstellen der sicheren Steuerung eines Computers, wobei das System einen nicht-sicheren Computer (100) und einen sicheren Computer (200) aufweist:

bei dem der nicht-sichere Computer eine dedizierte Videoausgabe mit einer Hardware-Schnittstelle (101) hat und zum Übertragen durch die Videoausgabe, in der Form von unkomprimierten Bitmap-Daten, eines Bildschirmbilds seiner Betriebssystemschnittstelle an den sicheren Computer über eine erste Verbindung und zum Empfangen von Anweisungen zum Steuern des nicht-sicheren Computers vom sicheren Computer über eine zweite Verbindung konfiguriert ist;

bei dem der sichere Computer zum Empfangen der Videoausgabe des nicht-sicheren Computers über die erste Verbindung und zum Übertragen von Anweisungen zum Steuern des nicht-sicheren Computers über die zweite Verbindung konfiguriert ist;

bei dem das System ferner eine Durchsetzeinrichtung (Enforcer) für unidirektionalen Datenfluss (400) aufweist, der zum Durchsetzen von unidirektionalem Datenfluss zwischen dem sicheren Computer und dem nicht-sicheren Computer über die zweite Verbindung konfiguriert ist, so dass Datenfluss vom sicheren Computer über die zweite Verbindung zum nicht-sicheren Computer zugelassen ist, aber Datenfluss vom nicht-sicheren Computer zum sicheren Computer über die zweite Verbindung verhindert wird;

wobei der sichere Computer (200) ferner zum Übertragen des Bildschirmbilds der Betriebssystemschnittstelle des nicht-sicheren Computers (100) an einen zweiten sicheren Computer (500) über eine dritte Verbindung und zum Empfangen von Anweisungen zum Steuern des nicht-sicheren Computers vom zweiten sicheren Computer über die dritte Verbindung konfiguriert ist; und wobei der sichere Computer (200) zum Komprimieren des Bildschirmbilds vor Weiterleiten desselben an den zweiten sicheren Computer (500) konfiguriert ist.

2. System nach Anspruch 1, wobei die Durchsetzeinrichtung für unidirektionalen Datenfluss (400) Folgendes aufweist:

entweder einen optischen Link, wobei der optische Link Übertragungshardware, die mit dem sicheren Computer (200) gekoppelt ist, und Empfangshardware, die mit dem nicht-sicheren Computer (100) gekoppelt ist, aufweist, wobei die Übertragungshardware einen Laser aufweist; oder

einen Link zur elektronischen Übertragung, wobei die elektronische Übertragung nur vom sicheren Computer zum nicht-sicheren Computer stattfinden kann, wobei der Link zur elektronischen Übertragung eine Verbindung eines seriellen Schnittstellenlinks ist, der für jede Kommunikationsrichtung verschiedene elektrische Verbindungen verwendet.

3. System nach einem der vorhergehenden Ansprüche, wobei die Durchsetzeinrichtung für unidirektionalen Datenfluss (400) eine angepasste elektronische Vorrichtung ist, die eine von folgenden ist: eine programmierbare logische Schaltung oder eine anwendungsspezifische integrierte Schaltung.

4. System nach einem der vorhergehenden Ansprüche, wobei die dedizierte Videoausgabe mit einer Hardware-Schnittstelle (101) eine der folgenden Schnittstellentechnologien ist: VGA, DVI, HDMI, DisplayPort oder DSI.

5. System nach einem der vorhergehenden Ansprüche, wobei die Durchsetzeinrichtung für unidirektionalen Datenfluss (400) zum Überwachen der über die zweite Verbindung übertragenen Anweisungen konfiguriert ist, wobei die Überwachung der über die zweite Verbindung übertragenen Anweisungen das Erstellen eines Protokolls der Anweisungen aufweist und wobei das Protokoll der Anweisungen über eine dedizierte Schnittstelle (401) an den sicheren Computer übertragen wird.

6. System nach einem der vorhergehenden Ansprüche, wobei die Anweisungen zum Steuern des nicht-sicheren Computers (100) Benutzeranweisungen sind, die mithilfe einer oder mehr Eingabevorrichtungen eingegeben werden.

7. System nach einem der vorhergehenden Ansprüche, wobei der nicht-sichere Computer (100) ferner zum Übertragen einer Audioausgabe an den sicheren Computer (200) über die erste Verbindung konfiguriert ist.

8. System, das das Computersystem nach einem der vorhergehenden Ansprüche aufweist und ferner den zweiten sicheren Computer (500) nach Anspruch 1 aufweist.

9. Verfahren zum Betreiben eines Computersystems zum Bereitstellen der sicheren Steuerung eines Computers, wobei das System einen nicht-sicheren Computer (100), einen sicheren Computer (200) und eine Durchsetzeinrichtung (Enforcer) für unidirektionalen Datenfluss aufweist, bei dem der nicht-sichere Computer eine dedizierte Videoausgabe mit einer Hardware-Schnittstelle (101) hat, wobei das Verfahren Folgendes aufweist:

Übertragen durch die Videoausgabe des nicht-sicheren Computers, in der Form von unkomprimierten Bitmap-Daten, eines Bildschirmbilds seiner Betriebssystemschnittstelle an den sicheren Computer über eine erste Verbindung zwischen dem nicht-sicheren Computer und dem ersten sicheren Computer;

durch den sicheren Computer Empfangen der Videoausgabe des nicht-sicheren Computers über die erste Verbindung;

Übertragen von Anweisungen zum Steuern des nicht-sicheren Computers über eine zweite Verbindung zwischen dem nicht-sicheren Computer und dem sicheren Computer von dem sicheren Computer an den nicht-sicheren Computer; und

durch den nicht-sicheren Computer Empfangen von Anweisungen zum Steuern des nicht-sicheren Computers von dem sicheren Computer über die zweite Verbindung;

durch die Durchsetzeinrichtung für unidirektionalen Datenfluss (400) Durchsetzen von unidirektionalem Datenfluss zwischen dem sicheren Computer und dem nicht-sicheren Computer über die zweite Verbindung, so dass Datenfluss vom sicheren Computer über die zweite Verbindung zum nicht-sicheren Computer zugelassen ist, aber Datenfluss vom nicht-sicheren Computer zum sicheren Computer über die zweite Verbindung verhindert wird;

Komprimieren des Bildschirmbilds der Betriebssystemschnittstelle des nicht-sicheren Computers (100) durch den sicheren Computer und Übertragen des komprimierten Bildschirmbilds der Betriebssystemschnittstelle des nicht-sicheren Computers (100) von dem sicheren Computer an einen zweiten sicheren Computer (500) über eine dritte Verbindung; und

durch den sicheren Computer Empfangen von Anweisungen zum Steuern des nicht-sicheren Computers vom zweiten sicheren Computer über die dritte Verbindung.

Revendications

1. Système informatique pour assurer la commande sécurisée d'un ordinateur, le système comprenant un ordinateur non sécurisé (100) et un ordinateur sécurisé (200) :

l'ordinateur insécurisé présentant une sortie vidéo dédiée avec une interface matérielle (101), et étant configuré pour transmettre, par la sortie vidéo, sous forme de données de table de bits non compressées, une image d'écran de son interface de système d'exploitation à l'ordinateur sécurisé sur une première connexion, et recevoir des instructions pour commander l'ordinateur insécurisé en provenance de l'ordinateur sécurisé sur une deuxième connexion ;

l'ordinateur sécurisé étant configuré pour recevoir la sortie vidéo de l'ordinateur insécurisé sur la première connexion et transmettre des instructions pour commander l'ordinateur insécurisé sur la deuxième connexion ;

le système comprenant en outre un exécuteur de flux de données unidirectionnel (400) configuré pour exécuter un flux de données unidirectionnel entre l'ordinateur sécurisé et l'ordinateur insécurisé sur la deuxième connexion, de telle sorte qu'un flux de données de l'ordinateur sécurisé sur la deuxième connexion à l'ordinateur insécurisé soit autorisé, mais un flux de données de l'ordinateur insécurisé à l'ordinateur sécurisé sur la deuxième connexion soit interdit ;

dans lequel l'ordinateur sécurisé (200) est configuré en outre pour transmettre l'image d'écran de l'interface système d'exploitation de l'ordinateur insécurisé (100) à un second ordinateur sécurisé (500) sur une troisième connexion, et recevoir des instructions pour commander l'ordinateur insécurisé en provenance du second ordinateur sécurisé sur la troisième connexion ; et dans lequel l'ordinateur sécurisé (200) est configuré pour compresser l'image d'écran avant de l'envoyer au second ordinateur sécurisé (500).

2. Système selon la revendication 1, dans lequel l'exécuteur de flux de données unidirectionnel (400) comprend soit :

une liaison optique, la liaison optique comprenant un matériel de transmission couplé à l'ordinateur sécurisé (200) et un matériel de réception couplé à l'ordinateur insécurisé (100), dans lequel le matériel de transmission comprend un laser ; soit

une liaison de transmission optique avec laquelle la transmission électronique ne peut se produire que de l'ordinateur sécurisé à l'ordinateur insécurisé, la liaison de transmission électronique étant une connexion d'une liaison de port série qui utilise différents connexions électriques pour chaque direction de communication.

3. Système selon n'importe quelle revendication précédente, dans lequel l'exécuteur de flux de données unidirectionnel (400) est un dispositif électronique personnalisé, étant un : d'un dispositif logique programmable ou d'un circuit intégré spécifique à l'application.

4. Système selon n'importe quelle revendication précédente, dans lequel la sortie vidéo dédiée à interface matérielle (101) est une des technologies d'interface suivantes : VGA, DVI, HDMI, DisplayPort ou DSI.

5. Système selon n'importe quelle revendication précédente, dans lequel l'exécuteur de flux de données unidirectionnel (400) est configuré pour surveiller les instructions transmises sur la deuxième connexion, la surveillance des instructions transmises sur la deuxième connexion comprenant la production d'un journal des instructions, et le journal des instructions étant transmis à l'ordinateur sécurisé sur une interface dédiée (401).

6. Système selon n'importe quelle revendication précédente dans lequel les instructions pour commander l'ordinateur insécurisé (100) sont des instructions d'utilisateur entrées à l'aide d'un ou plusieurs dispositifs d'entrée.

7. Système selon n'importe quelle revendication précédente dans lequel l'ordinateur insécurisé (100) est configuré en outre pour transmettre une sortie audio à l'ordinateur sécurisé (200) sur la première connexion.

8. Système comprenant le système informatique selon n'importe quelle revendication précédente et comprenant en outre le second ordinateur sécurisé (500) selon la revendication 1.

9. Procédé d'exploitation d'un système informatique pour assurer une commande sécurisée d'un ordinateur, le système comprenant un ordinateur insécurisé (100), un ordinateur sécurisé (200), et un exécuteur de flux de données unidirectionnel, l'ordinateur insécurisé présentant une sortie vidéo dédiée avec une interface matérielle (101), le procédé comprenant
la transmission, par la sortie vidéo de l'ordinateur insécurisé, sous la forme de données de table de bits non compressées, d'une image d'écran de son interface de système d'exploitation à l'ordinateur sécurisé sur une première connexion entre l'ordinateur insécurisé et le premier ordinateur sécurisé ;
la réception, par l'ordinateur sécurisé, de la sortie vidéo de l'ordinateur insécurisé sur la première connexion ;
la transmission, par l'ordinateur sécurisé à l'ordinateur insécurisé, d'instructions pour commander l'ordinateur insécurisé sur une deuxième connexion entre l'ordinateur insécurisé et l'ordinateur sécurisé ; et
la réception, par l'ordinateur insécurisé, d'instructions pour commander l'ordinateur insécurisé en provenance de l'ordinateur sécurisé sur la deuxième connexion ;
l'exécution, par l'exécuteur de flux de données unidirectionnel (400), d'un flux de données unidirectionnel entre l'ordinateur sécurisé et l'ordinateur insécurisé sur la deuxième connexion, de telle sorte qu'un flux de données de l'ordinateur sécurisé sur la deuxième connexion à l'ordinateur insécurisé soit autorisé, mais qu'un flux de données de l'ordinateur insécurisé à l'ordinateur sécurisé sur la deuxième connexion soit interdit ;
la compression, par l'ordinateur sécurisé, de l'image d'écran de l'interface de système d'exploitation de l'ordinateur insécurisé (100) et la transmission de l'image d'écran compressé de l'interface de système d'exploitation de l'ordinateur insécurisé (100) par l'ordinateur sécurisé à un second ordinateur sécurisé (500) sur une troisième connexion ; et
la réception, par l'ordinateur sécurisé, d'instructions pour commander l'ordinateur insécurisé en provenance du second ordinateur sécurisé sur la troisième connexion.

Drawing